Security firm Summer.fi has published a detailed post-mortem on the $6.04 million exploit that drained two of its Lazy Summer Protocol USDC vaults, concluding that the attack was planned months in advance rather than being an opportunistic flash loan exploit. According to the official report, the attacker spent roughly three months accumulating the assets needed to manipulate the protocol, with the exploit executed in a single atomic transaction on July 6. The report argues that the root cause was an operational issue during the offboarding of an old strategy rather than a flaw in the protocol's smart contracts, with the affected contracts behaving as designed despite the vulnerability.
According to the post-mortem, the attacker manipulated the net asset value (NAV) of two USDC vaults by donating stale-valued Silo vault tokens into an Ark that had been capped during an offboarding process. However, the Ark remained included in the vault's NAV calculations, artificially inflating the vault's share price and allowing the attacker to redeem shares at an inflated value. The losses were split between the Lower Risk USDC Vault, which lost about $5.64 million, and the Higher Risk USDC Vault, which lost roughly $400,000. The protocol also addressed the widely shared screenshot showing an annual percentage yield of roughly 2.08 million%, explaining that the figure resulted from a one-block spike in the vault's reported NAV and did not represent actual investment returns.
Summer.fi, formerly Oasis.app, operates as the front-end for the Lazy Summer Protocol, an onchain vault system that automatically routes deposits across DeFi yield sources like Aave and Morpho. The post-mortem reveals that the exploit stemmed from an incomplete vault offboarding process where an impaired Ark remained active in the vault's accounting after its deposit cap had been set to zero. The platform describes the Lazy Summer Protocol as a method for accessing DeFi yield through automation and risk curation, offering institutional vault infrastructure where entities can maintain control of private keys while accessing DeFi and real-world asset yield markets. The reported exploit puts automated vault systems under renewed market attention, as yield platforms typically route user funds across multiple lending, staking, and liquidity protocols to improve returns.
Following the exploit, all Lazy Summer Protocol vaults were paused and deposit caps were reduced to zero while the incident was investigated. According to the post-mortem, governance must now decide how to handle the affected vaults, whether to compensate users, and when unaffected vaults can safely resume operations. The report emphasizes that the exploit was not caused by compromised private keys, administrative privileges, or a coding bug, but rather by an operational issue that allowed the attacker to exploit the incomplete offboarding process. The protocol had $22 million in total value locked before the exploit, as reported by DeFiLlama data, with the incident marking the second crypto exploit recorded in July following a series of attacks in June when crypto platforms lost $75.87 million across 40 hacks.
